systemd-stub packs systemd credentials (*.cred) and system and configuration extensions (*.raw) from the directory of a UKI into its initrd, and none of them are signed or go through LoadImage(). With signed images forced, anyone able to write next to a UKI booted from a filesystem could pass credentials to the booted system, such as a root password.
With signed images forced, let OpenVolume() report EFI_UNSUPPORTED for every volume, the answer for "no filesystem here". This also keeps LoadImage() from loading images by file device path. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Johannes Schneider <[email protected]> --- efi/loader/protocols/file.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/efi/loader/protocols/file.c b/efi/loader/protocols/file.c index bfcf14f0e0..11b9e9e6f2 100644 --- a/efi/loader/protocols/file.c +++ b/efi/loader/protocols/file.c @@ -32,6 +32,7 @@ #include <fs.h> #include <linux/sprintf.h> #include <xfuncs.h> +#include <bootm.h> #define MAX_UTF8_PER_UTF16 3 @@ -1014,6 +1015,9 @@ efi_open_volume(struct efi_simple_file_system_protocol *this, EFI_ENTRY("%p, %p", this, root); + if (IS_ENABLED(CONFIG_BOOTM) && bootm_signed_images_are_forced()) + return EFI_EXIT(EFI_UNSUPPORTED); + /* No filesystem on the volume is EFI_UNSUPPORTED, not a device error */ if (!cdev_get_mount_path(fs->cdev)) { char *devpath = basprintf("/dev/%s", cdev_name(fs->cdev)); -- 2.43.0
